CVE-2024-23650

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with a panic. The issue has been fixed in v0.12.5. As a workaround, avoid using BuildKit frontends from untrusted sources.

• CWE-754

• https://github.com/moby/buildkit/pull/4601Patch, Vendor Advisory
• https://github.com/moby/buildkit/releases/tag/v0.12.5Patch, Release Notes
• https://github.com/moby/buildkit/security/advisories/GHSA-9p26-698r-w4hxVendor Advisory
• https://github.com/moby/buildkit/pull/4601Patch, Vendor Advisory
• https://github.com/moby/buildkit/releases/tag/v0.12.5Patch, Release Notes
• https://github.com/moby/buildkit/security/advisories/GHSA-9p26-698r-w4hxVendor Advisory

Published

Jan 31, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-23645GLPI is a Free Asset and IT Management Software package. A m…6.1
• CVE-2024-23646Pimcore's Admin Classic Bundle provides a backend user inter…8.8
• CVE-2024-23647Authentik is an open-source Identity Provider. There is a bu…8.8
• CVE-2024-23648Pimcore's Admin Classic Bundle provides a backend user inter…8.8
• CVE-2024-23649Lemmy is a link aggregator and forum for the fediverse. Star…6.5
• CVE-2024-2365A vulnerability classified as problematic was found in Music…4.2
• CVE-2024-23651BuildKit is a toolkit for converting source code to build ar…7.4
• CVE-2024-23652BuildKit is a toolkit for converting source code to build ar…9.1
• CVE-2024-23653BuildKit is a toolkit for converting source code to build ar…9.8
• CVE-2024-23654discourse-ai is the AI plugin for the open-source discussion…7.2
• CVE-2024-23655Tuta is an encrypted email service. Starting in version 3.11…5.3
• CVE-2024-23656Dex is an identity service that uses OpenID Connect to drive…7.5